|  | 6.4 | Extended ACLs
| 6.4.5 |
Writing an ACL that denies telnet out of an Ethernet port and permits all other traffic

The example in Figure denies Telnet traffic (eq 23) from 172.16.4.0 being sent out interface E0. All traffic from any other source to any destination is permitted, as indicated by the keyword any. Interface E0 is configured with the access-group 101 out command; that is, ACL 101 is linked to outgoing interface E0. Denying Only Telnet out of E0, and Permitting All Other Traffic access-list 101 deny tcp 172.16.4.0 0.0.0.255 any eq 23 access-list 101 permit ip any any (implicit deny any) (access-list 101 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 101 out